I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?


If you did want to lock things down.... a normal wordpress site will usually only require the database user to have SELECT, INSERT, UPDATE and DELETE.

If you want to use the automatic update feature it will also require CREATE and ALTER.

Some plugins may require other permissions but most won't.

| improve this answer | |

WordPress only uses one DB user for everything, and he'll need to have all permissions to the database. CREATE and ALTER are used when upgrading, sometimes. INSERT, UPDATE, and SELECT are used all the time.

| improve this answer | |

I've asked a similar but a bit more detailed question lately: MySQL Database User: Which Privileges are needed?

The short installation instruction for WordPress ("5 Minutes") state that:

Create a database for WordPress on your web server, as well as a MySQL user who has all privileges for accessing and modifying it.

This is the minimum of privileges / permissions that are needed and next to those, others are not needed.

So if your user has more privileges than those, you can reduce them.

| improve this answer | |

For a secure database, selecting ALL PRIVILEGES is definitely NOT the answer.

See the Codex: http://codex.wordpress.org/Hardening_WordPress

> 10 Database Security
>     10.1 Restricting Database User Privileges
| improve this answer | |
  • This is a bad advice, many plugins assume they can create tables and will just fail if they can't. Core itself might need to introduce new table or alter existing ones. – Mark Kaplun Mar 30 '16 at 9:42
  • 1
    As the codex explains, you have to know what you are doing and what is your purpose for doing it. Example 1: NO SECURITY If you want everything to work but do not care about security, then just enable everything and take your chances. Example 2: FULL SECURITY If you care about security, then read the codex article. When upgrading anything, you will need to REMEMBER to enable whatever privileges are required by the plugin or Wordpress upgrade. – Jerry9 Mar 30 '16 at 19:02
  • Mark Kaplun is correct... The original poster's (op) question does in fact say he is "not trying to lock things down." So assigning ALL privileges to your database will allow any and all Wordpress upgrades to work - that's the good advice for him (the op). By the way, here's an article that shows CATEGORIES for permissions (Data, Structure, Admin), wpwhitesecurity.com/wordpress-security-hacks/…. – Jerry9 Mar 30 '16 at 19:19
  • The only proper way to secure a WP DB is to have one per site, then you have one "root" user and you do not care much about permissions. But that is not what the OP asked. As for the article you point to... it is funny to discuss security when you have phpmyadmin installed and open to the web. What is the point of restricting the wordpress user when you have another that is not restricted (ok, there is a point, but still sloppy IMO). – Mark Kaplun Mar 30 '16 at 19:33

The answer is all privileges. This is taken straight from the wordpress install page here Look at the phpMyAdmin section and it states "Click Check All to select all privileges.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.